Mukesh,
This is not supported by the out-of-box authentication mechanisms. The e-mail and SMS OTP mechanisms are both self-contained and must complete individually before the next one is called.
In order to implement what you are requesting here you would need to build something bespoke. I think you would be able to use the built-in "send e-mail" mechanism to send the e-mail part of the OTP but you'd have to integrate manually with a 3rd party SMS gateway (using HTTP helper) to send the SMS part. So your policy would looks something like this:
1) Custom JavaScript mechanism to generate 2 part OTP and store parts in context. Also read e-mail address and mobile number from credential or LDAP
2) Use built in e-mail sending mechanism to send part 1 of OTP via e-mail to user. Alternatively use 3rd party e-mail sending service via REST/HTTP
3) Use custom JavaScript mechanism to send part 2 of OTP via 3rd party SMS service (using REST/HTTP)
4) Present challenge page to user asking for final OTP. Validate against values stored in context and allow access if correct.
This custom effort is not super-complex but it's not trivial either. I believe this is quite an unusual 2FA approach so perhaps worth validating with the business owner that there isn't some other suitable risk mitigation that could be used before going further down this road.
Jon.
------------------------------
Jon Harry
Consulting IT Security Specialist
IBM
------------------------------